Benign windows Download

gallery-dl

Legitimate PyInstaller gallery-dl bundle

“Command-line program to download image-galleries and -collections from several image hosting sites.”

Rule evaluation timeout: micro-behaviors/data/source/syntax/credential::hardcoded-service-credential-object took 204261ms (limit: 90000ms).rdata significantly larger than .text

SHA-256f9a810132003701af4115a0ee07e84c3f9dd3e59d91bd4a82949f32e6c4318e7

URLhttps://codeberg.org/mikf/gallery-dl/releases/download/v1.32.13/gallery-dl.exe

MaleculeK₄(Am₂Li₁₂Mc₃Te₂)O₁₁(Al₄As₁₇C₁₂Ca₄Dy₃Er₉I₄La₂P₂PrS₃)H₁₀(Cm₅₇Cr₂₀Db₂₈DsF₂₄Mg₅Os₁₆Po₂₃Ti₂U₂)Md₇(Bi₂₂Bk₂Pa₈PdPt₃Si₄)Th

Evidence

Largest PE section below ten percent 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400488b05f1f802008908488bc848895008H........H..H.P.
0x410e9ab300000cccccccccccccccccccccc..0.............
0x420488d05a96a0400c3ccccccccccccccccH...j...........
0x43048895c24204c89442418555657415541H.\$ L.D$.UVWAUA
0x440574883ec30488bea498bf8488d1502e7WH..0H..I..H....
0x4500200488bd941bdffffffffe8203f0000..H..A...... ?..
0x4604c8bf84885c07517488d5512488d0de5L..H..u.H.U.H...
0x470e60200e82823000033f6e9550100008b....(#..3..U....
0x48055044533c048039300100000498bcfe8U.E3.H......I...
0x490c403010085c0792de80f6a01004c8d4d......y-..j..L.M
0x4a0124c8d05e8e60200488d0d1de702008b.L......H.......
0x4b010e8ba240000498bcfe8f2fc000033f6...$..I.......3.
0x4c0e90f0100008b4d0c4c89642460e81e6a......M.L.d$`..j
0x4d001004c8be04885c075358b5d0ce8ca69..L..H..u5.]...i
0x4e001004c8d4d12895c24204c8d05efe602..L.M..\$ L.....
0x4f000488d0d2ce702008b10e87124000049.H..,......q$..I
0x5008bcfe8a9fc0000498bf4e9c000000033.......I.......3
0x510f6807d100175134d8bcc4533c0488bd5..}..u.M..E3.H..
0x520498bcfe8d8010000eb538b5d0c4c8974I........S.].L.t
0x53024684d8bf485db7438b8002000006690$hM....t8.. ..f.
0x540483bd8488bfb4d8bcf41b80100000048H;.H..M..A.....H
0x5500f47f8498bce488bd7e8aeff00004883.G.I..H.......H.
0x560f801722f4c03f7b800200000482bdf75..r/L.... ..H+.u
0x570cf8bc6488b7c24704c8b74246885c074...H.|$pL.t$h..t
0x58035498bcce857690100498bcfe81ffc005I...Wi..I......
0x59000eb3ce8146901004c8d4d124c8d0535..<..i..L.M.L..5
0x5a0e50200488d0d62e502008b10e8bf2300...H..b.......#.
0x5b000418bc5ebbd498bcfe8f2fb0000488b.A....I.......H.
0x5c0d7498bcc498bf4e8e43e0000448be84c.I..I....>..D..L
0x5d08b642460488bcee804690100488b5c24.d$`H....i..H.\$
0x5e078418bc54883c430415f415d5f5e5dc3xA..H..0A_A]_^].
0x5f0405556574156b838200000e8f0c30000@UVWAV.8 .......
0x600482be0488b05361e04004833c4488984H+.H..6...H3.H..
0x61024202000008b7a0c498bf0488bea4c8b$  ...z.I..H..L.
0x620f185ff0f84cd00000048899c24782000.........H..$x .
0x630004c89bc243020000041bf0020000090.L..$0 ..A.. ...
0x640493bff488d4c2420488bdf4d8bce490fI;.H.L$ H..M..I.
0x65047df41b801000000488bd3e8acfe0000G.A.....H.......
0x6604883f80172754c8bce488d4c242041b8H...ruL..H.L$ A.
0x67001000000488bd3e8e40501004883f801....H.......H...

Convert SID to string representation 0x2efc0–0x2f140

⋯3 more rows
0x2eff050794572725f436c6561720000000000PyErr_Clear.....
0x2f00050794572725f46657463680000000000PyErr_Fetch.....
0x2f01050794572725f4e6f726d616c697a6545PyErr_NormalizeE
0x2f0207863657074696f6e0000000000000000xception........
⋯7 more rows
0x2f0a05079496d706f72745f496d706f72744dPyImport_ImportM
0x2f0b06f64756c6500000050794c6973745f41odule...PyList_A
0x2f0c07070656e6400000050794d6172736861ppend...PyMarsha
⋯8 more rows

PyInstaller contents directory option 0x2fdf0–0x2fed0

⋯3 more rows
0x2fe2050795f47494c5f44495341424c454400Py_GIL_DISABLED.
0x2fe307079692d72756e74696d652d746d7064pyi-runtime-tmpd
0x2fe4069720000000000007079692d636f6e74ir......pyi-cont
0x2fe50656e74732d6469726563746f72790000ents-directory..
0x2fe607079692d686964652d636f6e736f6c65pyi-hide-console
⋯7 more rows

PyInstaller embedded PKG archive error 0x300c0–0x301c0

⋯3 more rows
0x300f02d0038002e000a000000000000000000-.8.............
0x30100436f756c64206e6f74206c6f61642050Could not load P
0x3011079496e7374616c6c6572277320656d62yInstaller's emb
0x30120656464656420504b4720617263686976edded PKG archiv
0x30130652066726f6d20746865206578656375e from the execu
0x301407461626c6520282573290a0000000000table (%s)......
0x30150436f756c64206e6f7420736964652d6cCould not side-l
⋯7 more rows

PyInstaller base library ZIP path 0x30340–0x30410

⋯3 more rows
0x3037064000000757466380000000064657600d...utf8....dev.
0x3038025735c626173655f6c6962726172792e%s\base_library.
0x303907a6970000000000025735c707974686fzip.....%s\pytho
0x303a06e25642e25645c6c69622d64796e6c6fn%d.%d\lib-dynlo
⋯7 more rows

SPDX license identifier lines 1–11

1/*!
2 * SPDX-License-Identifier: Unlicense
3 * This file was automatically generated by https://github.com/yt-dlp/ejs
4 *
5 * Bundled Dependencies:
⋯6 lines

Runs a high-iteration JavaScript loop lines 48–52

42… ARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
* ---
*/
52var lib=function(e){"use strict";const t=((e,t)=>{const r=new Uint32Array(69632);let n=0,o=0;for(;n<2571;){const i=e[n++];if(i<0)o-=i;else{let a=e[n++];2&i&&(a=t[a]),1&i?r.fill(a,o,o+=e[n++]):r[o++]=a}}return r})([-1,2,26,2,27,2,5,-1,0,77595648,3,44,2,3,0,14,2,63,2,64,3,0,3,0,3168796671,0,4294956992,2,1,2,0,2,41,3,0,4,0,4294966523,3,0,4,2,16,2,65,2,0,0,4294836735,0,3221225471,0,4294901942,2,66,0,134152192,3,0,2,0,4294951935,3,0,2,0,2683305983,0,2684354047,2,18,2,0,0,4294961151,3,0,2,2,19,2,0,0,608174079,2,0,2,60,2,7,2,6,0,4286611199,3,0,2,2,1,3,0,3,0,4294901711,2,40,0,4089839103,0,2961209759,0,1342439375,0,4294543342,0,3547201023,0, …

Single-line packed JavaScript loader profile line 52

52:1361… 8,0,2684354559,0,67044351,0,3221160064,2,17,-1,3,0,2,2,53,0,1046528,3,0,3,2,9,2,0,2,54,0,4294960127, …

charCodeAt() method call line 52

52:9619… 268434414,4294901763,4294901761]),r=e=>!!(1&t[(e>>>5)+34816]>>>e);function n(e){return e.column++,e.currentChar=e.source.charCodeAt(++e.index)}function o(e){const t=e.currentChar;if(55296!=(64512&t))return 0;const r=e.source.charCodeAt(e.index+1);return 56320!=(64512&r)?0:65536+((1023&t)<<10)+(1023&r)}function i(e,t){e.currentChar=e.source.charCodeAt(++e.index),e.flags|=1,4&t||(e.column=0,e.line++)}function a(e){e.flags|=1,e …

Repeated long numeric array literals line 52

52:10569…  143360&~e?4096&~e?"Punctuator":"Keyword":"Identifier"}}const u=[0,0,0,0,0,0,0,0,0,0,1032,0,0,2056,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8192,0,3,0,0,8192,0,0,0,256,0,33024,0,0,242,242,114,114,114,114,114,114,594,594,0,0,16384,0,0,0,0,67,67,67,67,67,67,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,0,1,0,0,4099,0,71,71,71,71,71,71,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,16384,0,0,0,0],p=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0],d=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,0];function g(e){return e<=127?p[e]>0:r(e)}function f(e){return e<=127?d[e]>0:(e=>!!(1&t[(e>>>5)+0]>>>e))(e)||8204===e||8205===e}const h=["SingleLine","MultiLine","HTMLOpen","HTMLClose","HashbangComment"];fu …

Showing the top 5 files — 8 more files (253 regions) not shown.